[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Glossary of Computer Security Terminology:

This National Institute of Standards and Technology Interagency Report (NISTIR) presents a glossary of computer security terminology, whose development was sponsored under the auspices of the National Security Telecommunications and Information Systems Security Committee (NSTISSC) . This glossary is a collection of terms and definitions used by various federal departments and agencies in their policies, standards, and other publications. This glossary did not seek to arrive at a single agreed-upon definition of each entry; therefore, some definitions may not be wholly consistent. Although never formally issued by the NSTISSC, since the document does reflect actual usage of these terms, it may provide a useful reference source to the computer security practitioner

NIST expresses its appreciation to the Subcommittee on Information Systems Security (SISS) and the Executive Secretariat of the National Security Telecommunications and Information Systems Security Committee for their kind permission to publish this report. We also wish to acknowledge the many computer security professionals who participated in the development of this glossary. - 2) The official authorization granted to an information system to process sensitive information in its operational environment based on comprehensive security evaluation of the system's hardware, firmware, and software security design, configuration and implementation and of the other system procedural, administrative, physical, TEMPEST, personnel and communications security controls. (APR 700-10)
- 3) The authorization and approval granted to a system or network to process classified or sensitive data. Accreditation will be made on the basis of certification by a competent authority that designated technical personnel have verified that specified technical requirements for achieving adequate data security have been met.

Glossary of Computer Security Terminology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Approaches for Federal Agencies to Use the Cybersecurity Framework:

----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Framework Profile.
Primary Cybersecurity Framework Components: Core, Profile(s) Summary: Federal agencies can use the Cybersecurity Framework Core Subcategories to align and merge cybersecurity requirements that may overlap or fall between offices in the organizational structure. This reconciliation helps to ensure compliance and prioritize requirements across the organization using the subcategory outcomes. This becomes a means of operationalizing cybersecurity | Framework Profile. Primary Cybersecurity Framework Components: Core, Profile(s) Summary: Federal agencies can use the Cybersecurity Framework Core Subcategories to align and merge cybersecurity requirements that may overlap or fall between offices in the organizational structure. This reconciliation helps to ensure compliance and prioritize requirements across the organization using the subcategory outcomes. This becomes a means of operationalizing cybersecurity |
| activities and a tool for iterative, dynamic, and prioritized risk management for the agency. Typical Participants: Risk Executive, Chief Information Officer (CIO), Senior Information Security                                                                                | activities and a tool for iterative, dynamic, and prioritized risk management for the agency.

Approaches for Federal Agencies to Use the Cybersecurity Framework


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

| PO.2.1: Create new roles and alter responsibilities for existing roles as needed to encompass all parts of the SDLC. Periodically review and maintain the defined roles and responsibilities, updating them as needed. | High       | R1: Include AI model development security in SDLC-related roles and responsibilities throughout the SDLC. The roles and responsibilities should include, but are not limited to, AI model development, AI model operations, and data science. N1: Roles and responsibilities involving AI system producers, AI model producers, and other third-party providers can be documented in agreements. | AI RMF: Govern 2.1                                        |
| Implement Roles and Responsibilities (PO.2): Ensure that everyone inside and outside of the organization involved in the SDLC is prepared to perform their SDLC-related roles and responsibilities throughout the SDLC. | PO.2.2: Provide role-based training for all personnel with responsibilities that contribute to secure development. Periodically review personnel proficiency and role-based training, and update the training as needed. | High       | R1: Role-based training should include understanding cybersecurity vulnerabilities and threats to AI models and their possible mitigations. | AI RMF: Govern 2.2 OWASP: LLM04-7                         |
| Implement Roles and Responsibilities (PO.2): Ensure that everyone inside and outside of the organization involved in the SDLC is prepared to perform their SDLC-related roles and responsibilities throughout the SDLC. | PO.2.3: Obtain upper management or authorizing official commitment to secure development, and convey that commitment to all with development- related roles and responsibilities. | Medium     | R1: Leadership should commit to secure development practices involving AI models.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Ransomware Risk Management_ A Cybersecurity Framework Profile:

| Category | Subcategory and Selected Informative References | Ransomware Application | |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Protect | Protect | Protect | | Identity Management, Authentication and Access Control (PR.AC): Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions.

Ransomware Risk Management_ A Cybersecurity Framework Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to NIST Cloud Computing Forensic Reference Architecture:

1. Architecture (e.g., diversity, complexity, provenance, multi-tenancy, data segregation). Architecture challenges in cloud forensics include:
2. o Dealing with variability in cloud architectures between providers
3. o Tenant data compartmentalization and isolation during resource provisioning
4. o Proliferation of systems, locations, and endpoints that can store data
5. o Accurate and secure provenance for maintaining and preserving chain of custody
2. Data collection (e.g., data integrity, data recovery, data location, imaging). Data collection challenges in cloud forensics include:
7. o Locating forensic artifacts in large, distributed, and dynamic systems
8. o Locating and collecting volatile data
9. o Data collection from virtual machines
10. o Data integrity in a multi-tenant environment where data is shared among multiple computers in multiple locations and accessible by multiple parties
11. o Inability to image all of the forensic artifacts in the cloud
12. o Accessing the data of one tenant without breaching the confidentiality of other tenants
13. o Recovery of deleted data in a shared and distributed virtual environment
3. Analysis (e.g., correlation, reconstruction, time synchronization, logs, metadata, timelines). Analysis challenges in cloud forensics include:
15. o Correlation of forensic artifacts across and within cloud providers
16. o Reconstruction of events from virtual images or storage
17. o Integrity of metadata

- o Timeline analysis of log data, including synchronization of timestamps
4. Anti-forensics (e.g., obfuscation, data hiding, malware). Anti-forensics is a set of techniques used specifically to prevent or mislead forensic analysis. Anti-forensic challenges in cloud forensics include:
- o The use of obfuscation, malware, data hiding, or other techniques to compromise the integrity of evidence
- o Malware may circumvent virtual machine isolation methods
5.

NIST Cloud Computing Forensic Reference Architecture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendations for Federal Vulnerability Disclosure Guidelines provide? (Part 2)

[Assistant]
aft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.
## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2023-05-17

## How to Cite this NIST Technical Series Publication:

Schaffer K, Mell P, Trinh H, Van Wyk I (2023) Recommendations for Federal Vulnerability Disclosure Guidelines. (National Institute of Standards and Technology, Gaithersburg, MD), NIST (Special Publication) NIST SP 800-216.

Recommendations for Federal Vulnerability Disclosure Guidelines

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0 provide?

[Assistant]
## NISTIR 6985

## COTS Security Protection Profile  - Operating Systems (CSPP-OS)

(Worked Example Applying Guidance of NISTIR-6462, CSPP)

Version 1.0

## Gary Stoneburner

U.S. DEPARTMENT OF COMMERCE Technology Administration National Institutes of Standards and Technology Gaithersburg, MD 20899

April 2003

<!-- image -->

U.S. DEPARTMENT OF COMMERCE Donald L. Evans, Secretary

TECHNOLOGY ADMINISTRATION Phillip J. Bond, Under Secretary of Commerce for Technology

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY Arden L. Bement, Jr., Director

## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical  leadership  for  the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive  unclassified  information  in  Federal  computer  systems. This  NIST  Interagency  Report (NISTIR)  reports  on  ITL's  research,  guidance,  and  outreach  efforts  in  computer  security,  and  its collaborative activities with industry, government, and academic organizations. Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. National Institute of Standards and Technology Interagency Report 6985 Natl. Inst. Stand.

COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Information Security Guide for Government Executives:

| Information Security Program Elements | Information Security Program Elements | |--------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Certification, Accreditation, and Security Assessments | Security certification and accreditation (C&A) are important activities that support a risk management process, and each is an integral part of an agency's information security program.

Information Security Guide for Government Executives


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to General Procedures for Registering Computer Security Objects:

- (a) mechanisms for maintaining the integrity and confidentiality of the registration database including adequate backup;
- (b) the design of appropriate forms (paper, electronic or both), containing the data elements specified;
- (c) a process for auditing the registration database and financial accounts;
- (d) management of the object name space.

This section shall cover object usage rules, handling instructions, and implementation details or restrictions beyond those imposed by the base standard. The text in this section may be used to clarify security tag information appearing in the Format Table. Examples are error conditions and their required system response such as return of an error response and local event auditing. The processing rules in Appendix B of the Standard Security Label FIPS may be referenced in this section. Explicit omissions, additions, or refinements to the processing rules in the SSL document also must appear in this section.

General Procedures for Registering Computer Security Objects


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Security for Full Virtualization Technologies provide? (Part 3)

[Assistant]
m individuals and organizations whose comments improved the overall quality of this publication. ## Trademark Information

All names are trademarks or registered trademarks of their respective owners.
## Table of Contents

| Executive Summary............................................................................................................ES-1   | Executive Summary............................................................................................................ES-1   | Executive Summary............................................................................................................ES-1                                                                                |                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction                                                                                | ................................................................................................................... 1-1             | ...................................................................................................................

Guide to Security for Full Virtualization Technologies


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Identification and Authentication?

[Assistant]
According to Personal Identity Verification (PIV) of Federal Employees and Contractors:

## Personal  Identity  Verification  (PIV) of  Federal  Employees  and  Contractors

## Category: Information Security Subcategory: Identity

Authentication  of  an  individual's  identity  is  a  fundamental  component  of  physical  and logical  access  control.  An  access  control  decision  must  be  made  when  an  individual attempts  to  access  security-sensitive  buildings,  information  systems,  and  applications.  An accurate  determination  of  an  individual's  identity  supports  making  sound  access  control decisions.

Personal Identity Verification (PIV) of Federal Employees and Contractors


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.5 (NIST 3.2.5)?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.3:

3.2.5                                                                                | The <xccdf:Value> Element                                                                                | ... 3.2.5 The <xccdf:Value> Element

Use of the <xccdf:source> , <xccdf:complex-value> , and <xccdf:complex-default> elements within the <xccdf:Value> element SHALL NOT be allowed.

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.3


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Security Assessment?

[Assistant]
According to Fiscal Year 2021 Cybersecurity and Privacy Annual Report:

18, NIST published a Federal Register notice that specified the technical requirements for the target cryptographic  algorithms  and  explained  the  evaluation  criteria  and  a  tentative  timeline.
The standardization process consists of multiple rounds, where, in each round, the field is narrowed to focus on the most promising candidates. In April 2019, NIST announced 56 first-round candidates, and after four months of evaluation, 32 of these candidates proceeded to the second round of evaluation.

Fiscal Year 2021 Cybersecurity and Privacy Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN):

A Hybrid Satellite Network (HSN), uses independently owned and operated terrestrial and space components to realize a space system that may provide extended global services across diverse missions and connecting points. The HSN architecture typically consists of a combination of independently owned terminals, antennas, satellites, payloads, or other components that communicate across disparate networks. An HSN may interact with government systems and critical infrastructure (as defined by the Department of Homeland Security) to provide services such as satellite-based communications, position, navigation, and timing (PNT), remote sensing, weather monitoring, and imaging. The components within an HSN are likely to have varying levels of trust among different components, requiring frameworks for establishing confidentiality and integrity of individual components while still enabling availability of required shared services. The HSN profile focuses on the complex variety of interfaces, data flows, and interactions with third-party services or component providers involved in modern HSNs. Many of these systems require connections to external partners or entities that are not trusted. Interfacing with untrusted systems requires the individual systems to understand and bound the inherited risk and assure their confidentiality, integrity, and availability. The HSN profile addresses concerns unique to HSN, and the reader is referred to other CSF profiles (such as NISTIR 8401, NISTIR 8323 and others) to address concerns to space system segments or components that are beyond this profile's scope.

Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Directions in Security Metrics Research:

Patches and software updates that are intended to repair or improve the security-enforcing mechanisms can lessen the significance of a lagging indicator. Not only does a reset of the baseline system occur with each change, potentially increasing risk [Bre07, Kei08, Lem08, Mar08, Nag08], but an exact picture of the initial baseline becomes obscured and more complicated to track over time (e.g., [Sto08]), making revised assessments impractical. That is, the presumed security posture of the initial baseline is never updated in light of increased understanding, potentially giving a false impression of the actual state. Several recent examples of dramatic shifts in our understanding of vulnerabilities in commonly used technologies, such as the Flash Player-ActionScript virtual machine [Dow08], OpenSSL cryptography [Dou08a, Gar08], MD5 algorithm in Web certificates [Pou08], and DNS protocol implementations [Dou08b], and also the prevalence of zero-day vulnerabilities indicate that with hindsight, unrevised values of lagging indicators could be highly misleading. - [Neu07] Stephan Neuhaus, Thomas Zimmermann, Christian Holler, Andreas Zeller, Predicting Vulnerable Software Components, ACM Conference on Computer and Communications Security (CCS '07), October 29-November 2, 2007, Alexandria, Virginia, http://www.st.cs.uni-sb.de/publications/files/neuhaus-ccs2007.pdf
- [Ozm06] Andy Ozment, Stuart Schechter, Milk or Wine: Does Software Security Improve with Age?, 15th USENIX Security Symposium, Vancouver, B.C., Canada, July 31-August 4, 2006, http://www.usenix.org/events/sec06/tech/full\_papers/ozment/ozment.pdf
- [Pay06] Shirley C.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1:

-  Risk Management Process - The organization's risk management practices are formally approved and expressed as policy. Organizational cybersecurity practices are regularly updated based on the application of risk management processes to changes in business/mission requirements and a changing threat and technology landscape. -  Integrated Risk Management Program - There is an organization-wide approach to manage cybersecurity risk. Risk-informed policies, processes, and procedures are defined, implemented as intended, and reviewed. Consistent methods are in place to respond effectively to changes in risk. Personnel possess the knowledge and skills to perform their appointed roles and responsibilities. The organization consistently and accurately monitors cybersecurity risk of organizational assets. Senior cybersecurity and non-cybersecurity executives communicate regularly regarding cybersecurity risk. Senior executives ensure consideration of cybersecurity through all lines of operation in the organization. -  External Participation - The organization understands its role, dependencies, and dependents in the larger ecosystem and may contribute to the community's broader understanding of risks. It collaborates with and receives information from other entities regularly that complements internally generated information, and shares information with other entities. The organization is aware of the cyber supply chain risks associated with the products and services it provides and that it uses. Additionally, it usually acts formally upon those risks, including mechanisms such as written agreements to communicate baseline requirements, governance structures (e.g., risk councils), and policy implementation and monitoring.

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Computer Security Division 2008 Annual Report:

| Computer Security Division Publications - FY 2008 | 53 55 | | Ways to Engage Our Division and NIST | | | Acknowledgements | 56 |

Computer Security Division 2008 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security Strategies for Microservices-based Application Systems provide? (Part 5)

[Assistant]
an of T-Mobile for valuable in-line comments and for providing additions to bibliography. Last but not the least, he expresses his thanks to Isabel Van Wyk of G2-Inc for her detailed editorial review.
## Patent Disclosure Notice

NOTICE: NIST's Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Executive Summary

The microservices paradigm is being increasingly used for designing and deploying large-scale application systems in both cloud-based and enterprise infrastructures. The resulting application system consists of relatively small, loosely coupled entities or components called microservices that communicate with each other using lightweight communication protocols. Incentives to design and deploy a microservices-based application system include: (a) agility in development due to relatively small and less complex codebases since each one typically implements a single business function; (b) independence among teams in the development process thanks to the loosely coupled nature of microservices; and (c) availability of deployment tools that provide infrastructure services such as authentication, access control, service discovery and communication, and load balancing.

Security Strategies for Microservices-based Application Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Resilient Interdomain Traffic Exchange_ BGP Security and DDoS Mitigation:

BGP origin validation relies on a global RPKI system (e.g., certificate authorities, publication repositories, etc.) as the source of trusted information about internet address holders and their route origin authorization statements. Each RIR operates a trusted root certificate authorit y (CA) in the RPKI system and publishes a Certificate Practice Statement [RFC7 382] describing the security and robustness properties of each implementation. Each RPKI CA has integrity and authentication mechanisms for data creation, storage, and transmission. Nevertheless, compromise of the underlying servers and/or registry services is still a potential, if low probability, threat. Making security recommendations for mitigating against such threats is outside of the scope of this document. Transport layer security is key to the integrity of messages communicated in BGP sessions. Making security recommendations for the underlying transport layer is also outside of the scope of this document. | [Mirai2]     | 'Dyn Analysis Summary of Friday October 21 Attack,' Dyn Company News, October 26, 2016. https://dyn.com/blog/dyn-analysis-summary-of- friday-october-21-attack/                                                                                |
|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [Murphy]     | S. Murphy, 'RPKI Tutorial: Routing Security and RPKI', NANOG on the Road (NOTR), St.

Resilient Interdomain Traffic Exchange_ BGP Security and DDoS Mitigation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guide to Cyber Threat Information Sharing:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

Rather than attempting to establish sharing agreements during an active cyber incident, organizations should plan ahead and have agreements in place before incidents occur. Such advanced planning helps ensure that participating organizations establish trusted relationships and understand their roles, responsibilities, and information handling requirements.

An organization can use shared threat information in many ways. Some uses are operationally oriented, such as updating enterprise security controls for continuous monitoring with new indicators and configurations to detect the latest attacks and compromises. Threat information may also be used strategically, such as using shared threat information as inputs when planning major changes to an organization's security architecture.

Guide to Cyber Threat Information Sharing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Attribute Considerations for Access Control Systems:

Once attributes and their allowable values are established, methods for provisioning attributes and appropriate attribute  values  to  subjects  and  objects  within  a  framework  for  storing,  retrieving, updating, or revoking attributes must also be established. In addition, interfaces and mechanisms must  be  developed  or  adopted  to  enable  sharing  of  these  attributes. Finally,  to  achieve  the assurance of attributes, an Attribute Evaluation Scheme, which brings confidence based on the five principal areas of interest, needs to be established:

NIST  Special  Publication  (SP)  800-162, Guide  to  Attribute  Based  Access  Control  (ABAC) Definition  and  Considerations [1],  introduced  guidance  on  access  control  definitions  and considerations  for  the  implementation  of  access  control  systems  but  did  not  include  detailed recommendations  on  considerations  such  as  the  preparation,  veracity,  security,  readiness,  and management of attributes. This document aims to provide federal agencies with a guide to attribute considerations  with  Attribute  Evaluation  Scheme  examples  for  access  control. The  Attribute Evaluation Scheme should be determined by an enterprise information system's requirements, and the enterprise information system should validate these requirements to realize the appropriate organizational attribute evaluation scheme  capability in line with  performance  and  cost recommendations. Note that this document does not establish a universal attribute scheme that suits all business capabilities and performance requirements; instead, it provides considerations and examples that can be adapted to meet the specific needs of an organization when defining its attribute evaluation scheme. |    | Executive Summary.....................................................................................................

Attribute Considerations for Access Control Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Cybersecurity Framework Version 1.1 Manufacturing Profile:

3.4.2 PM-9                  |
| IDENTIFY   | Risk Management Strategy (ID.

Cybersecurity Framework Version 1.1 Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to An Industrial Control System Cybersecurity Performance Testbed:

Receptacle for Machining Stations .....................................................................................12 | | 3.2.3.1 | Robot Assembly Table.....................................................................................................12 | Robot Assembly Table.....................................................................................................12 | | 3.2.4 | Emergency Stop Operation.................................................................................................13 | Emergency Stop Operation.................................................................................................13 | | 3.2.5 | Software Architecture.........................................................................................................14 | Software Architecture.........................................................................................................14 | | 3.2.5.1 | Control Layer...................................................................................................................14 | Control Layer...................................................................................................................14 | | 3.2.5.2 | PLC I/O Layer...................................................................................................................15 | PLC I/O Layer...................................................................................................................15 | | 3.2.5.3 | ROS Bags .........................................................................................................................15 | ROS Bags .........................................................................................................................15 | | 3.2.5.4 | ROS versus ROS Industrial...............................................................................................15 | ROS versus ROS Industrial...............................................................................................15 | | 3.2.5.5 | Theory of Operation........................................................................................................15 | Theory of Operation........................................................................................................15 | | 3.2.6 | Final Assembly.....................................................................................................................16 | Final Assembly.....................................................................................................................16 | | 3.3 | Third Enclave Concepts...............................................................................................................16 | Third Enclave Concepts...............................................................................................................16 | | 3.3.1 | Intelligent Transportation System ......................................................................................16 | Intelligent Transportation System ......................................................................................16 | | 3.3.2 | Wide-area Networks with SCADA.......................................................................................16 | Wide-area Networks with SCADA.......................................................................................16 |

An Industrial Control System Cybersecurity Performance Testbed


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to NIST Cloud Computing Forensic Reference Architecture:

Digital forensics is the application of science and technology to the discovery and examination of digital artifacts to establish facts and evidence concerning events and conditions that occur within information systems and networks. For decades, information processing systems have enabled the storage, processing, and transmission of information for public and private organizations and individuals. The maintenance, operation, and protection of these information systems have become paramount concerns since a disruption of sufficient magnitude or specific type could threaten business activities. In addition, the use of these systems in support of criminal activities has been of major concern. Digital forensics has traditionally been used for judicial proceedings and regulatory issues but may also be used for other purposes described below.

- NOTE 1: When this circle is reached, the challenge is neither technical nor non-technical. Fortunately, none of the challenges reach this node as none have this property. This node is included simply for logical completeness of the flowchart, so that every node has both a YES exit path and a NO exit path.
- NOTE 2: When this circle is reached, the capability is neither technical nor non-technical. There are a few capabilities that reach this node. However, these capabilities do not deal with issues directly related to digital forensics for cloud computing. Rather, they involve controlling physical access to facilities (e.g., using barriers, security patrols, checking physical ID cards.) and mitigating physical threats to facilities (e.g., installing fire suppression equipment).

A person who is an expert in acquiring, preserving, analyzing, and presenting digital evidence from computers and other digital media. This evidence may be related to both computer-based and non-cybercrimes, including security threats, cyber attacks, and other illegal activities.

NIST Cloud Computing Forensic Reference Architecture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Symposium on Federally Funded Research on Cybersecurity of Electric Vehicle Supply Equipment (EVSE):

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

Symposium on Federally Funded Research on Cybersecurity of Electric Vehicle Supply Equipment (EVSE)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Identification and Authentication?

[Assistant]
According to Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”:

|                                                       |
| 11:00AM - 11:55AM | IR 8259 Rev.
1 Preliminary Update: Session 1 Activity 1: Identify Expected Customers and Define Expected Use Cases and Activity 2: Research Customer Cybersecurity Needs and Goals          | Mike Fagan, NIST                                      |
| 11:55AM - 1:00 PM | Lunch Break                                                                                |                                                       |
| 1:00 PM - 1:45PM  | Afternoon Keynote Presentation: Leveraging FIDO Alliance cybersecurity standards in support of IR8259                                                                                | Brad Goodman (Fast Identity Online Alliance and Dell) |
| 1:45 PM - 2:45PM  | IR 8259 Rev. 1 Preliminary Update: Session 2 Activity 3: Determine How to Address Customer Needs and Goals and Activity 4: Plan for Adequate Support of Customer Needs and Goals            | Mike Fagan, NIST                                      |
| 2:45 PM - 3:00PM  | Break                                                                                |                                                       |
| 3:00 PM - 3:45PM  | IR 8259 Rev.

Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Case Studies in Cyber Supply Chain Risk Management_ Mayo Clinic:

..................................5 |

## Incident Response and Recovery

The key focus of the Mayo Clinic's cybersecurity and supply chain incident response plans is the continuation of patient care.
A dedicated business continuity team within the SCM manages supply chain resiliency events, which are often first identified by other hospitals and health networks that share the supplier. For instance, when the Illinois Environmental Protection Agency shut down the medical supply sterilization company Sterigenics v  in February 2019, the Mayo Clinic's business continuity team proactively engaged vendors reliant on Sterigenics to identify alternative sourcing. The business continuity team stores safety reserves of critical supplies to mitigate the impact of supply chain disruptions. While most Mayo Clinic facilities leverage high-efficiency 'just-in-time' operations and supply delivery, these reserves may be deployed to any facility in the network.

Case Studies in Cyber Supply Chain Risk Management_ Mayo Clinic


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness:

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8558/final, including related content, potential updates, and document history.

The team identified that firmware updates are critical to the cybersecurity of a smart teddy bear. Team participants also noted that privacy was also noted as a critical concern. The team envisioned utilizing videos and physical manuals to communicate with customers and users. They developed two manuals: one for parents and another for children, allowing for a more targeted audience approach. The adult manual was detailed and focused on salient tips and direct, easy access to resources. The child manual was designed around the idea that the child could help drive cybersecurity and that the product could help teach good cyber hygiene. For example, the eyes of the bear can glow red when an update is needed, prompting the child to seek help, as the team describes in their mock-up of the story book in Fig. 2.

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to CMVP Documentation Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach  efforts  in  information  system  security,  and  its  collaborative  activities  with  industry, government, and academic organizations.

CMVP Documentation Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to A Security Perspective on the Web3 Paradigm:

.............................22   |
| List of Tables                                                                                |
| Table 2.
Current web data model vs. Web3 data model.......................................................................6                           |

A Security Perspective on the Web3 Paradigm


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case:

## Revision to Include Updates in Cybersecurity Framework Version 1.1

The Cybersecurity Framework Manufacturing Profile, NISTIR 8183, is scheduled to be revised to include the updates in the Cybersecurity Framework Version 1.1, and will be published as NISTIR 8183, Revision 1.

Once NISTIR, 8183, Revision 1 has been released, this implementation guide will be revised to include the updates in the Cybersecurity Framework Version 1.1 as well, and will be published as NISTIR 8183A, Revision 1.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Computer Security Division 2006 Annual Report:

To keep pace with the rate of change in emerging technologies, we conduct a  large  amount  of  research  in  existing  and  emerging  technology  areas. Some of the many topics we research include smart card infrastructure and security, wireless  and  mobile  device  security, voice  over  Internet  Protocol (IP) security issues, digital forensics tools and methods, access control and authorization  management, Internet  Protocol  security, intrusion  detection systems, quantum information system security and quantum cryptography, and vulnerability analysis.  Our research helps to fulfill specific needs by the Federal government that would not be easily or reliably filled otherwise.

## Digital Handheld Device Forensics

The digital forensic community faces a constant challenge to stay on top of the latest technologies that may be used to recover evidence.  One such area concerns handheld device forensics.  Personal digital assistants (PDAs) and cell phones, including converged PDA/cell phone devices, are commonplace in  today's  society. They  are  used  by  individuals  for  both  personal  and professional purposes.  Handheld device technologies are evolving rapidly with new products and features being introduced regularly.  Rather than just placing calls, cellular  devices  can  allow  users  to  perform  additional  tasks such as Short Message Service (SMS) messaging, Multi-Media Messaging Service (MMS) messaging, Instant Messaging (IM), electronic mail exchange, Web browsing, Personal Information Management (PIM) maintenance (e.g., address  book,  task  list,  and  calendar  schedule),  and  even  the  reading, editing, and production of digital documents.  When used over time, these devices tend to accumulate a significant amount of information that may pertain to an incident or crime.

Computer Security Division 2006 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

CHAPTER ONE INTRODUCTION ............................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY .......................................................................................................... 1
1.2   TARGET AUDIENCE ............................................................................................................................ 4
1.3   RELATED PUBLICATIONS AND ASSESSMENT PROCESSES ............................................................... 4
1.4   ORGANIZATION OF THIS PUBLICATION ........................................................................................... 5
CHAPTER TWO THE FUNDAMENTALS ..................................................................................................... 6
2.1   ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION .................................................................................. 7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices:

Type.............................................................98 | | | C.3.5.8 System and Network Monitoring Information Type...............................................100 | | | C.3.5.9 Information Sharing Information Type...................................................................101 | | | APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED INFORMATION AND INFORMATION SYSTEMS......................................................102 | | | D.2 Homeland Security..............................................................................................................

Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Building Secure Microservices-based Applications Using Service-Mesh Architecture:

The definition and description of microservices-based application, threats, and security strategies for countering those threats are described in NIST SP 800-204, Security Strategies for Microservices-based Application Systems [1]. The purpose of this chapter is to recap and elaborate on the security requirements for this class of application to provide context for how those requirements are met by the functionality of the Service Mesh described in Chapter 3. This facilitates the development of deployment recommendations for Service Mesh components to meet those requirements in Chapter 4.

Building Secure Microservices-based Applications Using Service-Mesh Architecture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

re, software, and telecommunications components. These components can be a single software application or a combination of hardware/software focused on supporting a specific, mission-related function.
A major application may also consist of multiple individual applications if all are related to a single mission function (e.g., payroll or personnel). If a system is defined as a major application and the application is run on another organization's general support system, the major application owner is responsible for acceptance of risk and in addition:

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT):

| Figure 3 - Vehicle-to-Vehicle Communications.............................................................10 | | |--------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------| | Figure 4 - V2X Public Key Infrastructure Overview ......................................................11 | | | Figure 5 - Home Lighting Application............................................................................13 | | | Figure 6 - Precision Medicine Research Case | .............................................................16 | | Figure 7 - Diabetes Treatment/Allergen Identification...................................................17 | | | Figure 8 - IoT for the GSA Smart Building....................................................................20 | | | Figure 9 - An Example of a Smart Manufacturing Environment....................................21 | | | Figure 10 - Security Management Plan ........................................................................22 | | | List of Tables | | | Table 2 - IoT Components for Intelligent Buildings.................................................19 | | | Connected ID Networks Table 4 - Status of Cybersecurity Standardization for Several IoT Applications | .......................................................................................32 | | | ..56 | | Table 5 - IoT Key Capabilities Transformations .......................................................62 | | | Table 6 - IT Standards Maturity Model ......................................................................63 | | | Table 7 - Cryptographic Techniques Standards | ......................................................64 | | Table 8 - Cyber Incident Management Standards | ....................................................85 | | Table 9 - Hardware Assurance Standards | ................................................................90 | | Table 10 - Identity and Access Management Standards | .........................................93 | | Table 11 - Information Security Management Systems Standards | ......................101

Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Information System Security Best Practices for UOCAVA-Supporting Systems:

claimed identity of a user or system. Establishing the identity of a user is critical to the security of the system since the authenticated identity forms the basis for The strength of authentication necessary depends on the consequences of an authentication error. As such, users with more privileged levels of access should, in general, be authenticated with a higher level of assurance. For example, three likely classes of users on an IT system supporting UOCAVA voting are system administrator, election officials, and voters. Having insufficient authentication for a system administrator can have a much more negative effect on an election than having insufficient authentication of a particular voter because the system administrator has heightened privileges that allow them to affect the validity of votes from many voters. Identification and authentication in face-to-face environments are quite different than in electronic environments. In most cases, electronic authentication (particularly over the Internet) gives much less assurance than in face-to-face environments. For example, seeing a person who is holding a government-issued photo identity card such as a drivers license or passport gives much more assurance than seeing a copy of the photo identity card that was emailed. It should be noted that face-to-face voting normally employs much less stringent verification on government-issued identification than other environments, such as in aviation security screening. Still, physical interaction with physical identification such as drivers' licenses gives a greater opportunity for better authentication than online systems. In this discussion, the person who is asserting his or her identity is called the claimant and the party trying to assess the authenticity of the identity is the verifier . NIST SP 800-63 Rev.

Information System Security Best Practices for UOCAVA-Supporting Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

3.2.1 Job Classifications... 3.2.1 Job Classifications... 3.2.1 Job Classifications...

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Managing Information Security Risk_ Organization, Mission, and Information System View:

Organizational risk can include many types of risk (e.g., program management risk, investment risk, budgetary risk, legal liability risk, safety risk, inventory risk, supply chain risk, and security risk). Security risk related to the operation and use of information systems is just one of many components of organizational risk that senior leaders/executives address as part of their ongoing risk management responsibilities. Effective risk management requires that organizations operate in highly complex, interconnected environments using state-of-the-art and legacy information systems-systems that organizations depend on to accomplish their missions and to conduct important business-related functions. Leaders must recognize that explicit, well-informed riskbased decisions are necessary in order to balance the benefits gained from the operation and use of these information systems with the risk of the same systems being vehicles through which purposeful attacks, environmental disruptions, or human errors cause mission or business failure. Managing information security risk, like risk management in general, is not an exact science. It brings together the best collective judgments of individuals and groups within organizations responsible for strategic planning, oversight, management, and day-to-day operations-providing both the necessary and sufficient risk response measures to adequately protect the missions and business functions of those organizations. The third component of risk management addresses how organizations respond to risk once that risk is determined based on the results of risk assessments.

Managing Information Security Risk_ Organization, Mission, and Information System View


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN) provide?

[Assistant]
<!-- image -->

## NIST Interagency Report NIST IR 8441

## Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN)

James McCarthy

Dan Mamula

Joseph Brule

Karri Meldorf

Rory Jennings

John Wiltberger

Chris Thorpe

John Dombrowski

O'Ryan Lattin

Sam Sepassi

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8441

<!-- image -->

## NIST Interagency Report NIST IR 8441

## Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN)

James McCarthy*

National Cybersecurity Center of Excellence National Institute of Standards and Technology

Dan Mamula Joseph Brule Karri Meldorf Rory Jennings John Wiltberger Chris Thorpe John Dombrowski O'Ryan Lattin Sam Sepassi

The MITRE Corporation

*Former NIST employee; all work for this publication was done while at NIST. This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8441

September 2023

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Proxy Validation and Verification for Critical AI Systems_ A Proxy Design Process:

| Table of Contents                                                                                |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| Executive Summary............................................................................................................................1      |
| 1. Introduction...................................................................................................................................2 |
| 2. CAIS Validation and Verification Process -5phases.......................................................................3                        |
| 2.2.1. Physical Operational Environment...............................................................................................5             |
| 2.2.2. Application Purpose .....................................................................................................................5   |
| 2.2.3. Operational Characteristics..........................................................................................................6       |
| 2.2.4. AI/ML Development Algorithms...................................................................................................6             |
| 2.2.5. AI/ML Development Techniques..................................................................................................7              |
| 2.2.6. CAIS and Proxy Taxonomy Template............................................................................................7                |
| References.......................................................................................................................................11 |
| Appendix A.

Proxy Validation and Verification for Critical AI Systems_ A Proxy Design Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

............................................................. 16
3.1   ACCESS CONTROL ..................................................................................................................
18
3.2   AWARENESS AND TRAINING ................................................................................................... 59
3.3   AUDIT AND ACCOUNTABILITY ................................................................................................. 65
3.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 83
3.5   CONFIGURATION MANAGEMENT ........................................................................................... 96
3.6   CONTINGENCY PLANNING .................................................................................................... 115
3.7   IDENTIFICATION AND AUTHENTICATION ............................................................................... 131
3.8   INCIDENT RESPONSE ............................................................................................................ 149
3.9   MAINTENANCE .................................................................................................................... 162
3.10   MEDIA PROTECTION .......................................................................................................... 171
3.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .................................................................... 179
3.12   PLANNING ........................................................................................................................ 194
3.13   PROGRAM MANAGEMENT ................................................................................................. 203
3.14   PERSONNEL SECURITY ........................................................................................................ 222
3.15   PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY .......................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Analyzing Collusion Threats in the Semiconductor Supply Chain provide? (Part 3)

[Assistant]
..................5                     |
| 4. Case Study .....................................................................................................................................8  |
| 5.
Conclusion and Future Work.........................................................................................................12              |
| References.......................................................................................................................................13   |
| List of Figures                                                                                |
| Fig. 1. Security challenges in the semiconductor supply chain..............................................................2                          |
| Fig. 2. Methodology for supply chain threat analysis...........................................................................5                      |
| Fig. 3. Threat severity levels for colluding adversaries in the context of hardware Trojan insertion ......6                                          |
| Fig. 4. Threat severity levels for colluding adversaries in context of logic obfuscation ........................10                                   |

## 1. Introduction

There are numerous security challenges in the semiconductor supply chain. As most chip design companies have become fabless, they rely on offshore foundries for fabrication. This is especially true for the most advanced technology nodes, and the semiconductor supply shock in 2021 has manifested these supply chain security issues. In addition to availability uncertainty, there are many more nuanced security risks in the current semiconductor supply chain, such as IP theft, counterfeiting, Trojan insertion, and reverse engineering. In order to counteract these security risks, many types of solutions have been proposed, ranging from design to test phases of the supply chain.

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide for Mapping Types of Information and Information Systems to Security Categories provide? (Part 3)

[Assistant]
dation  or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.
There  are  references  in  this  publication  to  documents  currently  under  development  by  NIST  in  accordance  with responsibilities  assigned  to  NIST  under  the  Federal  Information  Security  Management  Act  of  2002. The methodologies in this document may be used even before the completion of such companion documents. Thus, until such  time  as  each  document  is  completed,  current  requirements,  guidelines,  and  procedures  (where  they  exist) remain operative. For planning and transition purposes, agencies may wish to closely follow the development of these new documents by NIST. Individuals are also encouraged to review the public draft documents and offer their comments  to  NIST. All  NIST  documents  mentioned  in  this  publication,  other  than  the  ones  noted  above,  are available at http://csrc.nist.gov/publications. COMMENTS MAY BE SUBMITTED TO THE COMPUTER SECURITY DIVISION, INFORMATION TECHNOLOGY LABORATORY, NIST VIA ELECTRONIC MAIL AT SEC-CERT@NIST.GOV OR VIA REGULAR MAIL AT 100 BUREAU DRIVE (MAIL STOP 8930), GAITHERSBURG, MD 20899-8930

## Acknowledgements

The authors, Kevin Stine, Rich Kissel, and William C. Barker, wish to thank their colleagues, Jim Fahlsing and Jessica Gulick from Science Applications International Corporation (SAIC), who helped update this document, prepare drafts, and review materials. In addition, special thanks are due to our reviewers, Arnold Johnson (NIST), Karen Quigg (Mitre Corporation), and Ruth Bandler (Food and Drug Administration), who greatly contributed to the document's development. A special note of thanks goes to Elizabeth Lennon for her superb technical editing and administrative support.

Guide for Mapping Types of Information and Information Systems to Security Categories


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Computer Security_ Selected Articles:

e users of significant developments in both security' measures and evolving problem categories. - Administer the access control package(s) which run on facilities under control of the DP organization.
In this role, the administrator will only permit access to those persons authorized access by those with primary responsibility tor data security. - Take leadership responsibility for determining, by working with the user areas and the Legal Department. the need for a data classification programme. If one is needed, take the lead in developing one that satisfies the potentially diverse needs of the user community. - Develop an Employee Data Security Awareness Programme which will adequately sensitize employees to the importance of their cooperation in the corporate data security program. - Develop educational programmes for user-area management in the use of currently available audit packages for the critical review and evaluation of their data. These users need to be able, whenever possible, to detect data integrity problems before they become any more costly than necessary. This matter is complex and quite beyond the scope of this particular paper - but it is nevertheless very important.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objectives for Cybersecurity:

The U.S. standards system differs significantly from the government-driven, centrally-coordinated standards systems common in many other countries. Within the United States, there are hundreds of SDOs, which are overwhelmingly private sector organizations, providing the infrastructure for the preparation of standards documents.  USG personnel participate in SDO activities along with representatives from industry, academia, and other organizations and consumers.  In many other countries' standards systems, the government plays a larger role in standards development-related activities, which provides those governments the ability to use standards to support domestic industrial and innovation policy, rather than to advance technical solutions in support of public policy goals.  While Federal agencies possess certain responsibilities related to standards, such as in their own use of standards or in their development of technical regulations, there is a much greater reliance in the U.S. on the private sector, including companies and industry groups, academic institutions, professional societies, consumer groups, and other interested parties, in standards development.  The United States Standards Strategy 8 , elaborated through a private and public sector partnership in 2000, and revised most recently in 2010, outlines the contribution of private-sector led standards development to overall competition and innovation in the U.S. economy and the imperative of public and private sector participation that is a central tenet of the U.S. approach to standardization.

Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objectives for Cybersecurity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Computer Security Division 2008 Annual Report:

| Computer Security Division Publications - FY 2008 | 53 55 | | Ways to Engage Our Division and NIST | | | Acknowledgements | 56 |

Computer Security Division 2008 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Transitioning to the Security Content Automation Protocol (SCAP) Version 2:

dent [13] information are currently being developed in the IETF Managed Incident Lightweight Exchange (MILE) [14] and the IETF Security Automation and Continuous Monitoring (SACM) [15] working groups.
A ROLIE repository discovery mechanism [16] and a JSON-based version of ROLIE are also being developed in IETF MILE. Once completed, these solutions will be implemented in the NVD, and can be implemented by vendors to support SCAP content discovery and exchange. - NIST IR 8085: In support of the transition from CPE to SWID, an automated method is needed to support the generation of a CPE Name from a SWID tag to support legacy SCAP v1 tools. Draft NISTIR 8085 [17] is a start to support generation of CPE names from SWIDs, but more work is needed to complete this specification.

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out:

The Contractor shall review network security, evaluating its confidentiality, integrity, and availability. This review shall include, as applicable, access control, authentication, security administration, type and security of network media, security of file and print servers, encryption, interfaces between network and operating system/application software security modules, and conformance to networking standards.

A security plan prepared under OMB Bulletin 90-08 should be an abstract of the detailed security plan for the system. If a detailed security plan does not exist, the OMB Bulletin 90-08 plan can be a starting point. The detailed plan will contain significantly more information in such areas as risk analysis, contingency planning, backup procedures, personnel screening and selection, password management, user identification and authentication, and audit and variance detection.

The second area measures the impact of a hardware or software product designed to perform a direct computer security function. Examples of this include a virus scanning package, a PC-based access control package, a mainframe access control system, an accounting add-on to an operating system, an encryption device, or a smart card-based identification and authentication system.

Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Information Security Handbook_ A Guide for Managers:

| 1. Introduction .................................................................................................... | 1. Introduction .................................................................................................... | 1. Introduction .................................................................................................... | 1. Introduction ....................................................................................................

Information Security Handbook_ A Guide for Managers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guidelines on PDA Forensics:

Linux offers comprehensive support for security that has been part of the operating system from its onset. Features include user identification and authentication, access control on files and  directories  based  on  owner  (user/group/all),  logging  of  security-relevant  activities,  and various  levels  of  network  encryption  (Point-to-Point  Tunneling  Protocol  (PPTP),  Internet Protocol Security (IPsec), Secure Shell (SSH), etc.). Processes running under Linux on the same machine are also protected from interfering with one another [Ket00]. Linux operating systems tailored for PDAs have on occasion been found to contain security vulnerabilities in design  and  implementation  that  affect  system  security. For  example,  the  screen-locking passcode on the Zaurus that provides user authentication, created the same random value (i.e., salt value 15 ) every time the passcode was set. This oversight weakened security by allowing

-  Identification - Recognize and determine the type of incident. -  Preparation - Prepare tools, techniques, search warrants, authorizations, and management approval. -  Approach Strategy - Maximize untainted evidence collection while minimizing the impact upon the victim. -  Preservation - Isolate, secure, and preserve the state of physical and digital evidence. -  Collection - Record the physical scene and duplicate digital evidence. -  Examination - Search for evidence relating to the suspected crime. -  Analysis - Determine significance, reconstruct fragments of data, and draw conclusions based on the evidence found. The Analysis phase may go through numerous iterations until a theory has been supported. -  Presentation - Summarize and provide an explanation of conclusions.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1:

3.4.2 ISO/IEC 27001:2013 Clause 6. 3.4.2 ISO/IEC 27001:2013 A.

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guide for Security-Focused Configuration Management of Information Systems:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

Guide for Security-Focused Configuration Management of Information Systems